Host-risk warnings: desktop apps that change coding-agent configs
Public-incident warnings, not our hands-on tests. Public-incident warnings about desktop or host apps that change coding-agent configs, plugins, hooks or MCP connections without a clear opt-in. Verification is public incident reports, not our hands-on test. No exploit steps are published here.
1 warning. Last updated . Agents: JSON at /api/host-risks.json; MCP is_dangerous returns matching entries as host_risks.
| Host | What was reported | What agents should do | Sources |
|---|---|---|---|
| Postman Desktop Postman Desktop 12.33.4 (also reported on later 12.3x builds before revert) | Postman Desktop silently auto-installed coding-agent plugins and attempted SessionStart hook trust Public reports say opening or updating Postman Desktop on macOS auto-installed Postman plugins into Claude Code and Codex (and could touch Cursor), added SessionStart hook instructions that steer broad API work into Postman skills, wired a remote Postman MCP connection, and the installer attempted to self-approve the Codex hook trust record. Postman later said they would redesign the opt-in and were reverting the change. This is a consent and trust-boundary risk: a desktop API client changing other agents' configs without a clear, specific opt-in in those agents. | After installing or updating desktop API tools, audit ~/.codex/config.toml (marketplaces, plugins, hooks.state), Claude Code plugin settings (~/.claude/settings.json and installed plugins), Cursor/Copilot agent plugin lists, and unexpected MCP server entries. Treat SessionStart hooks and vendor skills as untrusted until a human reviewed them. Prefer uninstalling unwanted vendor plugins from the agent host, not only from the desktop app. | GitHub issue postmanlabs/postman-app-support#14370 public incident reports, not our hands-on test |